# Reading a table from an external file

**URL:** <https://community.zeek.org/t/reading-a-table-from-an-external-file/3742>\
**Category:** Zeek\
**Created:** [July 30, 2015, 3:15pm UTC](https://community.zeek.org/t/reading-a-table-from-an-external-file/3742 "2015-07-30T15:15:40Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Earl\_Eiland](https://avatars.discourse-cdn.com/v4/letter/e/df705f/32.png) [@Earl\_Eiland](https://community.zeek.org/u/Earl_Eiland)\
**Post date:** [July 30, 2015, 3:15pm UTC](https://community.zeek.org/t/reading-a-table-from-an-external-file/3742/1 "2015-07-30T15:15:40Z")

</div>

I recently saw something online about reading a table from an external file in a bro script. Now that I’m ready to do that, I can’t find any references or code examples. Can anyone provide some links?

Best Regards,

Earl Eiland,

Sr. Cyber Security Engineer,

Emerging Technologies, root9B,

San Antonio, Texas

---

<div class="post-metadata">

**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\
**Post date:** [July 30, 2015, 3:24pm UTC](https://community.zeek.org/t/reading-a-table-from-an-external-file/3742/2 "2015-07-30T15:24:34Z")

</div>

It's the input framework: [https://www.bro.org/sphinx/frameworks/input.html](https://www.bro.org/sphinx/frameworks/input.html)

Robin

---

<div class="post-metadata">

**Author:** ![Earl\_Eiland](https://avatars.discourse-cdn.com/v4/letter/e/df705f/32.png) [@Earl\_Eiland](https://community.zeek.org/u/Earl_Eiland)\
**Post date:** [July 30, 2015, 7:47pm UTC](https://community.zeek.org/t/reading-a-table-from-an-external-file/3742/3 "2015-07-30T19:47:03Z")

</div>

This is what I remembered. Thanks, Robin.

Naturally, I can't follow the example. My table will have three fields, all of which are sets. How can I read in sets?

Earl

---

<div class="post-metadata">

**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\
**Post date:** [July 31, 2015, 2:53pm UTC](https://community.zeek.org/t/reading-a-table-from-an-external-file/3742/4 "2015-07-31T14:53:23Z")

</div>

Take a look at the test in  
testing/btest/scripts/base/frameworks/input/setseparator.bro, that  
reads in a set, using '|' as the element separator. (If you don't set  
that explicitly, it's comma instead.)

Btw, the test suite has a bunch of more tests for the input framework,  
which can provide inspiration for more involved use cases that aren't  
covered elsewhere.

Robin

---

<div class="post-metadata">

**Author:** ![Earl\_Eiland](https://avatars.discourse-cdn.com/v4/letter/e/df705f/32.png) [@Earl\_Eiland](https://community.zeek.org/u/Earl_Eiland)\
**Post date:** [July 31, 2015, 5:26pm UTC](https://community.zeek.org/t/reading-a-table-from-an-external-file/3742/5 "2015-07-31T17:26:56Z")

</div>

Thanks, Robin.

I don't see the path you mention below on github. How do I find it?

Earl

---

<div class="post-metadata">

**Author:** ![Earl\_Eiland](https://avatars.discourse-cdn.com/v4/letter/e/df705f/32.png) [@Earl\_Eiland](https://community.zeek.org/u/Earl_Eiland)\
**Post date:** [July 31, 2015, 5:28pm UTC](https://community.zeek.org/t/reading-a-table-from-an-external-file/3742/6 "2015-07-31T17:28:27Z")

</div>

Ignore my previous email. I found it.

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:42pm UTC](https://community.zeek.org/t/reading-a-table-from-an-external-file/3742/7 "2022-05-06T15:42:55Z")

</div>